Legal

Data Processing Agreement

This DPA applies where GxP Seal processes personal data on a customer's behalf. It reflects how the app actually works: everything stays inside Atlassian, with Atlassian as the only sub-processor.

1Definitions & roles

• Controller — the Customer, who determines the purposes and means of processing personal data within its Confluence instance.
• Processor — the Provider (GxP Seal, LLC), which processes personal data solely to provide the app on the Controller's instructions.
• Data Subjects — the individuals who sign or are named in signatures: employees, contractors and external parties.
• Terms such as personal data, processing, sub-processor and supervisory authority have the meanings given in the GDPR.

2Nature, purpose & duration

• Purpose: to provide electronic-signature execution, two-component verification, server-generated timestamping and tamper-evident audit logging, within the Atlassian Forge environment.
• Duration: for the term of the Customer's subscription; processing ends when the app is uninstalled (see §7).
• Instructions: the Provider processes personal data only per this DPA and the Controller's documented instructions, and will tell the Controller if an instruction appears to infringe applicable law.

3Categories of personal data

The app processes only:

• the signer's printed name and email address;
• the signer's Atlassian account ID;
• the signing credential the user sets — stored only as a salted scrypt hash, never plaintext, never logged;
• signature metadata: meaning, server timestamp, page id/version, space, and a SHA-256 content hash (not the page body);
• audit / flow-event records, including account IDs of notified users.

No special-category data is intended to be processed. The app collects no IP addresses and uses no PKI keys or certificates.

4Security measures

• The app runs on Atlassian Forge and stores data in Atlassian-hosted storage; encryption in transit and at rest is provided by the Atlassian platform. The Provider operates no infrastructure of its own.
• Signing credentials are salted-hashed (scrypt), verified in constant time, and never logged. Page content is not stored — only its hash.
• Integrity is tamper-evident: a SHA-256 hash chain makes any alteration detectable.
• Provider personnel have no direct access to Customer production data or credentials in the ordinary course; access for support occurs only at the Customer's request under confidentiality.

5Sub-processors

The Controller authorises Atlassian Pty Ltd (Atlassian Cloud / Forge) as the sole sub-processor for hosting and storage. The Provider uses no other sub-processors; timestamps are server-generated within Forge. The Provider will inform the Controller of any intended change and allow objection.

6Data-subject requests & assistance

Taking into account the nature of processing, the Provider will assist the Controller with GDPR data-subject requests (access, rectification, erasure, restriction, portability, objection) and with obligations under Articles 32–36 (security, breach notification, DPIAs). Note that signature and audit records are append-only compliance evidence; erasure of a signature may conflict with the Controller's own records-retention obligations and will be handled per the Controller's documented instructions.

7Return & deletion

On termination or uninstall, the app's storage for the Customer's site is removed in accordance with the Atlassian Forge data lifecycle. The Provider retains no separate copy, as it operates no storage of its own.

8International transfers

The Provider is a US company; where personal data of EU/UK data subjects is processed, transfers rely on an appropriate safeguard such as the Standard Contractual Clauses. Because storage is Atlassian-hosted and residency-inherited, the app introduces no transfer of its own beyond Atlassian's arrangements. The Provider's GDPR Art. 27 EU representative is stated in the Privacy Policy.

9Audit

The Provider will make available information reasonably necessary to demonstrate compliance with this DPA — including its security description and the published verification method — and will contribute to an audit on reasonable prior notice, no more than once per year, or by relying on Atlassian's third-party certifications.

10Liability & governing law

Liability is capped and governed as set out in the End User License Agreement. Governing law: Delaware, USA, unless otherwise agreed in a signed order.